Tools

Tools

Highly inspired by The Bug Hunter’s Methodology Jason Haddix @jhaddix.

Seeds/Roots

• crt.sh crt.sh | Certificate Search

• Shodan Search Engine

• Home - Censys

ASN Enumeratiom

• bgp.he.net

• Asnlookup

• Metabigor

Reverse WHOIS

• whoxy.com

• DOMLink

Ad/Analytics Relationships

• builtwith.com (also available as Firefox addon)

• getrelationship.py

Google-Fu

• Copyright text

• Terms of service text

• Privacy policy test

Subs

Linked and JS Discovery

• Burp Suite Pro (or ZAP Proxy?)

• GoSpider

• hakrawler

• Subdomainizer

• subscraper

Subdomain Scraping

site:twitch-tv -www.twicht.tv

site:twitch-tv -www.twicht.tv -watch.twitch.tv

• Amass amass enum ...

• Subfinder v2

• github-subdomains.py

• github-search (unstable -> run multiple times)

• shosubgo

• Cloud Ranges (scan all AWS, Azure, etc. check SSL certs for "target")

• Sublist3r GitHub - aboul3la/Sublist3r: Fast subdomains enumeration tool for penetration testers

Subdomain Bruting

• Massdns

• Amass amass enum -brute -d twitch.tv -src

• aisdnsbrute

• shuffleDNS

• altdns

• Knockpy GitHub - guelfoweb/knock at knock4

• HostileSubBrutforcer GitHub - nahamsec/HostileSubBruteforcer

Wordlists

• all.txt

• AssetNote -> commonspeak2

Favicon Analysis

• favfreak

Port Analysis

• Nmap

• masscan (faster than Nmap)

• dnmasscan

• Brutespray

GitHub Dorking

• github-search

Screenshotting

• Aquatone

• Eyewitness

• httpscreenshot

• WitnessMe

Subdomain takeover

• can-i-take-over-xyz

• Nuclei

• SubOver

Automation++

• interlace

• Tools by TomNomNom (eg httpprobe, mage)

Frameworks

S-Tier

• AssetNote

• SpiderFoot

• Project Discovery Framework

• Jaeles (scanner)

• Osmedeus

• Bunty.offensiveai.com (paid)

• reNgine

• Scout (paid)

A-Tier

• Findomain Monitoring Service

• Rock-ON (A One-Shoot Killer)

• Automated Reconnaissance Pipeline

B-Tier

• LazyRecon

• Automated-Scanner

• OneForAll

• Chomp Scan

• domained [archived]

• Sudomy

• Gorecon - lightweight Reconnaissance Tool [NO LONGER MAINTAINED]

• TugaRecon

• Photon

C-Tier

• bountyRecon

• recon

• Recon-tools

• AutoRecon

• Hunter

• ultimate_recon.sh

• st8out.sh

MISC (to be cleaned up)

• WebScarab

• Recon-ng

• GitRob

• CyberChef

• OnlineHashCrack.com

• idb

• Wireshark

• Bucket Finder

• Race the Web

• Google Dorks

• JD GUI

• Mobile Security Framework

• Ysoserial